Task Mgr/ registry editing disabled???

TherealpizzakingTherealpizzaking Northwest MO
edited July 2005 in Spyware & Virus Removal
I'm back.. just as promised...

thanks in advance for looking at my post.

Got a few problems with a laptop I recently purchased from a pawn dealer.

Computer was loaded with a ton of crap and has several viruses. Pest patrol was already installed and finds several registry entry problems. Upon trying to fix them, computer gives me a message that Registry editing has been disabled. Task Manager also has been disabled and won't open in safe mode either.

I tried another trick as posted in a previous post by going to Start>Run>and typing "gpedit.msc" and editing the User configuration>Administrative templates>system>Ctrl+Alt+Delete Options to Not Configured, but still didn't work. (Current setting was already Not Configured...)

Virus protection --> AVG is also on computer and recently updated and scanned.

Spyware Doctor and Spybot S & D are also installed and updated. I removed several of the problems with these programs, but I'm still having trouble with the ones Pest Patrol won't remove (these are the ones that are giving me the message "Registry editing has been disabled by Administrator")

I posted at Castlecops already but haven't had much response (I know, Crunchie, you warned me...)

Anyway.. here is the latest HJT log...


Logfile of HijackThis v1.99.1
Scan saved at 3:18:35 PM, on 7/21/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\LEXBCES.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\LEXPPS.EXE
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\SPOOLSVR.EXE
D:\WINDOWS\System32\hkcmd.exe
D:\WINDOWS\BCMSMMSG.exe
D:\PROGRA~1\PESTPA~1\PPControl.exe
D:\PROGRA~1\PESTPA~1\PPMemCheck.exe
D:\PROGRA~1\PESTPA~1\CookiePatrol.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\MSN Messenger\msnmsgr.exe
D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
D:\Program Files\Spyware Doctor\swdoctor.exe
D:\Program Files\Intuit\QuickBooks Pro\Components\QBAgent\qbdagent2001.exe
D:\WINDOWS\system32\mrtMngr.EXE
D:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
D:\Program Files\Linksys\Wireless-G Notebook Adapter\WPC54Cfg.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\iNtfySvc\intfysvc.exe
D:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\Program Files\WinRAR\WinRAR.exe
D:\DOCUME~1\PONYEX~1\LOCALS~1\Temp\Rar$EX00.500\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - D:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - D:\Program Files\Ipswitch\WS_FTP Pro\wsbho2k0.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - D:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [IgfxTray] D:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] D:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [qnwapibkzegmq] D:\WINDOWS\System32\ooiwonu.exe
O4 - HKLM\..\Run: [PestPatrol Control Center] D:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [PPMemCheck] D:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] D:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [PestPatrolCL] D:\PROGRA~1\PESTPA~1\PestPatrolCL.exe c:\
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Spyware Doctor] "D:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: QuickBooks 2001 Delivery Agent.lnk = D:\Program Files\Intuit\QuickBooks Pro\Components\QBAgent\qbdagent2001.exe
O4 - Global Startup: Wireless-G Notebook Adapter Utility.lnk = D:\Program Files\Linksys\Wireless-G Notebook Adapter\Startup.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\WINDOWS\system32\msjava.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - D:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: D:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Tegrity-WebLearner-2385 - http://cite.nwmissouri.edu/tegrity/FreshSemValues/MJ%20Review%203a/Class/TWebS.CAB
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1099985017395
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://198.209.246.36/msrdp.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O20 - Winlogon Notify: igfxcui - D:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Adobe LM Service - Unknown owner - D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Ipswitch Notification Server (inotifysvr) - Ipswitch, Inc. 10 Maguire Road - Suite 220 Lexington MA. - C:\iNtfySvc\intfysvc.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - D:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Macromedia - D:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NICSer_WPC54G - Unknown owner - D:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe

Thanks in advance for checking out my problems.... hope you can help..

PK

Comments

  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited July 2005
    Hi again :).

    ===============

    We'll need to unload Spybot's Teatimer before we begin. To do this can you start Spybot and go to Tools > Resident and uncheck the box next to Tea-Timer. Make sure that the icon in the system tray is no longer there. If it is, just right click on it and select "Exit". Do not forget to re-enable it when we are done :).

    ===============

    Run HiJackThis, click "Scan", then check(tick) the following, if present:


    O4 - HKLM\..\Run: [qnwapibkzegmq] D:\WINDOWS\System32\ooiwonu.exe

    O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System, DisableRegedit=1
    ...(Unless you've restricted the use of registry editing, have HiJackThis fix this.)


    Now, close all instances of Internet Explorer and any other windows you have open except HiJackThis, click "Fix checked".

    ===============

    Locate and delete the following item(s), if present. Make sure you are able to view system and hidden files/ folders:

    files...

    D:\WINDOWS\System32\ooiwonu.exe

    -

    Note that some of these file(s)/folder(s) may or may not be present. If present, and cannot be deleted because they're 'in use', try deleting them in "Safe Mode".

    -

    Reboot.

    ===============

    After rebooting, rescan with hijackthis and post back a new log. Please let me know how your pc is now.
  • TherealpizzakingTherealpizzaking Northwest MO
    edited July 2005
    I must have had a bad version of spybot, because the tools menu wasn't found. I disabled it in the system tray and fixed the items you requested above.... Ran HJT again and the "O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System, DisableRegedit=1 " line showed up again... :(

    reloaded spybot with the latest download, installed it again, and then un-checked Spybot's Tea-timer as you asked above (the menu list was complete now).

    Ran HJT again, fixed the "07 - HKCU..."
    (the 07 HKCU...ooiwonu.exe was not showing up), althought after I ran spybot the first time after fixing the problems noted, I got an error message that an important registry entry was changed...
    (Entry was gnwapibkzegmq --> location was d:\windows\system32\ooiwonu.exe )

    I didn't see it in the HJT logthis time, but then again, I'm not completely sure what I'm looking for.

    Task manager is still disabled as is registry editing...

    Here is the latest HJT log:

    Logfile of HijackThis v1.99.1
    Scan saved at 12:49:29 AM, on 7/23/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    D:\WINDOWS\System32\smss.exe
    D:\WINDOWS\system32\csrss.exe
    D:\WINDOWS\system32\winlogon.exe
    D:\WINDOWS\system32\services.exe
    D:\WINDOWS\system32\lsass.exe
    D:\WINDOWS\system32\svchost.exe
    D:\WINDOWS\system32\svchost.exe
    D:\WINDOWS\System32\svchost.exe
    D:\WINDOWS\System32\svchost.exe
    D:\WINDOWS\System32\svchost.exe
    D:\WINDOWS\system32\LEXBCES.EXE
    D:\WINDOWS\system32\spoolsv.exe
    D:\WINDOWS\system32\LEXPPS.EXE
    D:\WINDOWS\Explorer.EXE
    D:\WINDOWS\SPOOLSVR.EXE
    D:\WINDOWS\System32\hkcmd.exe
    D:\WINDOWS\BCMSMMSG.exe
    D:\PROGRA~1\PESTPA~1\PPControl.exe
    D:\PROGRA~1\PESTPA~1\PPMemCheck.exe
    D:\PROGRA~1\PESTPA~1\CookiePatrol.exe
    D:\PROGRA~1\PESTPA~1\PestPatrolCL.exe
    D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    D:\WINDOWS\system32\ctfmon.exe
    D:\Program Files\MSN Messenger\msnmsgr.exe
    D:\Program Files\Spyware Doctor\swdoctor.exe
    D:\Program Files\Intuit\QuickBooks Pro\Components\QBAgent\qbdagent2001.exe
    D:\WINDOWS\system32\mrtMngr.EXE
    D:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
    D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    D:\Program Files\Linksys\Wireless-G Notebook Adapter\WPC54Cfg.exe
    C:\iNtfySvc\intfysvc.exe
    D:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    D:\WINDOWS\System32\svchost.exe
    D:\WINDOWS\System32\wdfmgr.exe
    D:\WINDOWS\System32\alg.exe
    D:\WINDOWS\system32\wscntfy.exe
    D:\WINDOWS\system32\wuauclt.exe
    D:\WINDOWS\System32\wbem\wmiprvse.exe
    D:\Documents and Settings\ponyexpress\My Documents\My program downloads\HijackThis.exe

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - D:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
    O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - D:\Program Files\Ipswitch\WS_FTP Pro\wsbho2k0.dll
    O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - D:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O4 - HKLM\..\Run: [IgfxTray] D:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] D:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
    O4 - HKLM\..\Run: [PestPatrol Control Center] D:\PROGRA~1\PESTPA~1\PPControl.exe
    O4 - HKLM\..\Run: [PPMemCheck] D:\PROGRA~1\PESTPA~1\PPMemCheck.exe
    O4 - HKLM\..\Run: [CookiePatrol] D:\PROGRA~1\PESTPA~1\CookiePatrol.exe
    O4 - HKLM\..\Run: [PestPatrolCL] D:\PROGRA~1\PESTPA~1\PestPatrolCL.exe c:\
    O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [Spyware Doctor] "D:\Program Files\Spyware Doctor\swdoctor.exe" /Q
    O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: QuickBooks 2001 Delivery Agent.lnk = D:\Program Files\Intuit\QuickBooks Pro\Components\QBAgent\qbdagent2001.exe
    O4 - Global Startup: Wireless-G Notebook Adapter Utility.lnk = D:\Program Files\Linksys\Wireless-G Notebook Adapter\Startup.exe
    O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\WINDOWS\system32\msjava.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\WINDOWS\system32\msjava.dll
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - D:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: D:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: Tegrity-WebLearner-2385 - http://cite.nwmissouri.edu/tegrity/FreshSemValues/MJ%20Review%203a/Class/TWebS.CAB
    O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1099985017395
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
    O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
    O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://198.209.246.36/msrdp.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O20 - Winlogon Notify: igfxcui - D:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O23 - Service: Adobe LM Service - Unknown owner - D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: Ipswitch Notification Server (inotifysvr) - Ipswitch, Inc. 10 Maguire Road - Suite 220 Lexington MA. - C:\iNtfySvc\intfysvc.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - D:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: Macromedia Licensing Service - Macromedia - D:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
    O23 - Service: NICSer_WPC54G - Unknown owner - D:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe

    Thanks crunchie.. let me know what you think


    PK
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited July 2005
    Scan with hijackthis and tick the boxes next to all the following entries, then close all browser and explorer windows and hit the "Fix checked" button.

    O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System, DisableRegedit=1

    Are you getting an error message saying it had been disabled by your administrator?

    If so, download the following utility and see how it goes.

    http://www.dougknox.com/

    Go to Win XP Utilities then 'disable/enable Task Manager.
  • TherealpizzakingTherealpizzaking Northwest MO
    edited July 2005
    Thanks for the link Crunchie, but I've already tried the task manager utility on dougknox.

    everytime I run HJT and fix the entry above (07-HKCU...) it comes back as soon as I run HJT. The task manager is never enabled.

    Any other suggestions?

    Thanks.

    PK

    and yes, I'm getting the error message shown (Task manager has been disabled by your administrator)
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited July 2005
    Let's see if silent runners finds anything.

    Go here and download and run Silent Runners.vbs. It generates a log, please post the information back in this thread.
    If you have a script blocking program, please allow the file to run. It is not malicious.
  • TherealpizzakingTherealpizzaking Northwest MO
    edited July 2005
    Thanks again Crunchie... here is the log you requested...

    "Silent Runners.vbs", revision 39, http://www.silentrunners.org/
    Operating System: Windows XP SP2
    Output limited to non-default values, except where indicated by "{++}"


    Startup items buried in registry:

    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
    "msnmsgr" = ""D:\Program Files\MSN Messenger\msnmsgr.exe" /background" [MS]
    "Spyware Doctor" = ""D:\Program Files\Spyware Doctor\swdoctor.exe" /Q" ["PCTools"]
    "ctfmon.exe" = "D:\WINDOWS\system32\ctfmon.exe" [MS]

    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
    "IgfxTray" = "D:\WINDOWS\System32\igfxtray.exe" ["Intel Corporation"]
    "HotKeysCmds" = "D:\WINDOWS\System32\hkcmd.exe" ["Intel Corporation"]
    "BCMSMMSG" = "BCMSMMSG.exe" ["Broadcom Corporation"]
    "PestPatrol Control Center" = "D:\PROGRA~1\PESTPA~1\PPControl.exe" ["Computer Associates International"]
    "PPMemCheck" = "D:\PROGRA~1\PESTPA~1\PPMemCheck.exe" [null data]
    "CookiePatrol" = "D:\PROGRA~1\PESTPA~1\CookiePatrol.exe" ["Computer Associates International"]
    "PestPatrolCL" = "D:\PROGRA~1\PESTPA~1\PestPatrolCL.exe c:\" ["Computer Associates International, Inc."]
    "AVG7_CC" = "D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP" ["GRISOFT, s.r.o."]
    "KernelFaultCheck" = "D:\WINDOWS\system32\dumprep 0 -k" [MS]

    HKLM\Software\Microsoft\Active Setup\Installed Components\
    {6M8A6G00-3I18-11C0-821H-444200140P0S}\(Default) = (no title provided)
    \StubPath = "D:\WINDOWS\system32\Tapi32init.exe" [null data]

    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
    {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]
    -> {CLSID}\InProcServer32\(Default) = "D:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string]
    {53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
    -> {CLSID}\InProcServer32\(Default) = "D:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]
    {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB}\(Default) = "PCTools Site Guard" [from CLSID]
    -> {CLSID}\InProcServer32\(Default) = "D:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll" ["PC Tools"]
    {601ED020-FB6C-11D3-87D8-0050DA59922B}\(Default) = "Ipswitch.WsftpBrowserHelper"
    -> {CLSID}\InProcServer32\(Default) = "D:\Program Files\Ipswitch\WS_FTP Pro\wsbho2k0.dll" ["Ipswitch, Inc. 10 Maguire Road - Suite 220 Lexington, MA 02421"]
    {B56A7D7D-6927-48C8-A975-17DF180C71AC}\(Default) = "PCTools Browser Monitor" [from CLSID]
    -> {CLSID}\InProcServer32\(Default) = "D:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll" ["GuideWorks Pty. Ltd."]

    HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
    "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Display Panning CPL Extension"
    -> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
    "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext"
    -> {CLSID}\InProcServer32\(Default) = "D:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
    "{5464D816-CF16-4784-B9F3-75C0DB52B499}" = "Yahoo! Mail"
    -> {CLSID}\InProcServer32\(Default) = "D:\PROGRA~1\Yahoo!\Common\ymmapi.dll" ["Yahoo! Inc."]
    "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
    -> {CLSID}\InProcServer32\(Default) = "D:\Program Files\WinRAR\rarext.dll" [null data]
    "{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
    -> {CLSID}\InProcServer32\(Default) = "D:\WINDOWS\System32\Audiodev.dll" [MS]
    "{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
    -> {CLSID}\InProcServer32\(Default) = "D:\WINDOWS\System32\Audiodev.dll" [MS]
    "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
    -> {CLSID}\InProcServer32\(Default) = "D:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS]
    "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler"
    -> {CLSID}\InProcServer32\(Default) = "D:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS]
    "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler"
    -> {CLSID}\InProcServer32\(Default) = "D:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS]
    "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Shell Extension"
    -> {CLSID}\InProcServer32\(Default) = "D:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
    "{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Find Extension"
    -> {CLSID}\InProcServer32\(Default) = "D:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]

    HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
    INFECTION WARNING! igfxcui\DLLName = "igfxsrvc.dll" ["Intel Corporation"]

    HKLM\Software\Classes\PROTOCOLS\Filter\
    INFECTION WARNING! text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}"
    -> {CLSID}\InProcServer32\(Default) = "D:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS]

    HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
    AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"
    -> {CLSID}\InProcServer32\(Default) = "D:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
    HexWorkshopContextMenu\(Default) = "{DB34D5DC-D41A-482E-A5EF-8FA0F88761DA}"
    -> {CLSID}\InProcServer32\(Default) = "D:\Program Files\BreakPoint Software\Hex Workshop 4.2\hwext.dll" ["BreakPoint Software, Inc."]
    WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
    -> {CLSID}\InProcServer32\(Default) = "D:\Program Files\WinRAR\rarext.dll" [null data]
    WS_FTP\(Default) = "{797F3885-5429-11D4-8823-0050DA59922B}"
    -> {CLSID}\InProcServer32\(Default) = "D:\Program Files\Ipswitch\WS_FTP Pro\wsftpsi.dll" ["Ipswitch, Inc. 10 Maguire Road - Suite 220 Lexington, MA 02421"]
    Yahoo! Mail\(Default) = "{5464D816-CF16-4784-B9F3-75C0DB52B499}"
    -> {CLSID}\InProcServer32\(Default) = "D:\PROGRA~1\Yahoo!\Common\ymmapi.dll" ["Yahoo! Inc."]

    HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
    WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
    -> {CLSID}\InProcServer32\(Default) = "D:\Program Files\WinRAR\rarext.dll" [null data]

    HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
    AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"
    -> {CLSID}\InProcServer32\(Default) = "D:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
    WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
    -> {CLSID}\InProcServer32\(Default) = "D:\Program Files\WinRAR\rarext.dll" [null data]
    WS_FTP\(Default) = "{797F3885-5429-11D4-8823-0050DA59922B}"
    -> {CLSID}\InProcServer32\(Default) = "D:\Program Files\Ipswitch\WS_FTP Pro\wsftpsi.dll" ["Ipswitch, Inc. 10 Maguire Road - Suite 220 Lexington, MA 02421"]


    Default executables:

    .SCR: HKLM\SOFTWARE\Classes\AutoCADScript\shell\open\command\
    INFECTION WARNING! "Default" = "D:\WINDOWS\NOTEPAD.EXE "%1"" [MS]


    Group Policies [Description] {enabled Group Policy setting}:

    HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\
    HIJACK WARNING! "DisableRegistryTools"=dword:00000001
    [prohibits launch of REGEDIT.EXE]
    {User Configuration|Administrative Templates|System|Prevent access to
    registry editing tools}


    Active Desktop and Wallpaper:

    Active Desktop is disabled at this entry:
    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

    HKCU\Control Panel\Desktop\
    "Wallpaper" = "D:\WINDOWS\web\wallpaper\Bliss.bmp"


    Enabled Screen Saver:

    HKCU\Control Panel\Desktop\
    "SCRNSAVE.EXE" = "D:\WINDOWS\System32\logon.scr" [MS]


    Startup items in "ponyexpress" & "All Users" startup folders:

    D:\Documents and Settings\All Users\Start Menu\Programs\Startup
    "Adobe Gamma Loader" -> shortcut to: "D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."]
    "QuickBooks 2001 Delivery Agent" -> shortcut to: "D:\Program Files\Intuit\QuickBooks Pro\Components\QBAgent\qbdagent2001.exe" [empty string]
    "Wireless-G Notebook Adapter Utility" -> shortcut to: "D:\Program Files\Linksys\Wireless-G Notebook Adapter\Startup.exe" [empty string]


    Enabled Scheduled Tasks:

    "TASK20041111223948" -> launches: "D:\Program Files\Ipswitch\WS_FTP Pro\wsftppro.exe -m "D:\Documents and Settings\Bobby\Application Data\Ipswitch\WS_FTP\Scheduler\sch44.tmp"" [null data]
    "TASK20041129102105" -> launches: "D:\Program Files\Ipswitch\WS_FTP Pro\wsftppro.exe -m "D:\Documents and Settings\Bobby\Application Data\Ipswitch\WS_FTP\Scheduler\sch62.tmp"" [null data]


    Winsock2 Service Provider DLLs:

    Namespace Service Providers

    HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
    000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
    000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
    000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

    Transport Service Providers

    HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
    0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
    %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15
    %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


    Toolbars, Explorer Bars, Extensions:

    Explorer Bars

    Dormant Explorer Bars in "View, Explorer Bar" menu

    HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\ = "&Research"
    Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
    InProcServer32\(Default) = "D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS]

    Extensions (Tools menu items, main toolbar menu buttons)

    HKLM\Software\Microsoft\Internet Explorer\Extensions\
    {2D663D1A-8670-49D9-A1A5-4C56B4E14E84}\
    "ButtonText" = "Spyware Doctor"
    "CLSIDExtension" = "{A1EDC4A1-940F-48E0-8DFD-E38F1D501021}"
    -> {CLSID}\InProcServer32\(Default) = "D:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll" ["GuideWorks Pty. Ltd."]

    {92780B25-18CC-41C8-B9BE-3C9C571A8263}\
    "ButtonText" = "Research"

    {FB5F1910-F110-11D2-BB9E-00C04F795683}\
    "ButtonText" = "Messenger"
    "MenuText" = "Windows Messenger"
    "Exec" = "D:\Program Files\Messenger\msmsgs.exe" [MS]


    Running Services (Display Name, Service Name, Path {Service DLL}):

    AVG7 Alert Manager Server, Avg7Alrt, "D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe" ["GRISOFT, s.r.o."]
    AVG7 Update Service, Avg7UpdSvc, "D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe" ["GRISOFT, s.r.o."]
    Ipswitch Notification Server, inotifysvr, "C:\iNtfySvc\intfysvc.exe" ["Ipswitch, Inc. 10 Maguire Road - Suite 220 Lexington MA. "]
    LexBce Server, LexBceS, "D:\WINDOWS\system32\LEXBCES.EXE" ["Lexmark International, Inc."]
    Machine Debug Manager, MDM, ""D:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE"" [MS]
    Windows User Mode Driver Framework, UMWdf, "D:\WINDOWS\System32\wdfmgr.exe" [MS]

    + This report excludes default entries except where indicated.
    + To see *everywhere* the script checks and *everything* it finds,
    launch it from a command prompt or a shortcut with the -all parameter.
    + The search for DESKTOP.INI DLL launch points on all local fixed drives
    took 37 seconds.
    + The search for all Registry CLSIDs containing dormant Explorer Bars
    took 35 seconds.
    (total run time: 102 seconds)
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited July 2005
    Download Killbox v2.0.0.175 and unzip the file to your Desktop and have it ready to use.

    --

    Download the attached zip file and unzip fixme.reg.

    --

    Save the below file to a text document (notepad) to be used shortly.

    D:\WINDOWS\system32\Tapi32init.exe

    --

    Reboot into safe mode following the instructions here.

    --

    Close all browser windows. Double click on the fixme.reg file to run it and when asked if you want to merge with your registry, answer yes.

    --

    Open the text file you saved previously and right click and drag your cursor over the file to highlight it and then use Control+C to copy it to the clipboard.
    Open KILLBOX and go to File...."Paste From Clipboard". The file should now appear in the box. Then checkmark the "Delete on Reboot" box..and click the red X. You will get a message saying "File will be deleted on next reboot" , Process and Reboot now?" Click "Yes" and post a new hijackthis log and a silent runners log when you have rebooted.
  • TherealpizzakingTherealpizzaking Northwest MO
    edited July 2005
    Save the below file to a text document (notepad) to be used shortly.

    D:\WINDOWS\system32\Tapi32init.exe

    Not to sound like a dumbass or anything, but how do I save this to notepad? I searched and found the file, and tried to open it in notepad, then save it as a .txt document, but all the characters were jibberish....


    I'm sure this isn't what you want me to do... sorry for the dumb question, and thanks again for all the help!

    PK
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited July 2005
    Highlight the file path from my previous post and copy the text. Right click on the desktop and create a new text file and paste the file path into the text file.
  • TherealpizzakingTherealpizzaking Northwest MO
    edited July 2005
    Ok.. I had a brain fart. I woke this morning realizing exactly what you were requesting with the notepad.

    Also, to get you completely up to speed, this laptop had two users that could log on in windows xp startup screen. Bobby, and dell. I had been using the dell user all along in previous posts, but when I went in safe mode, the "dell" user wasn't there, only "bobby" and "administrator". I couldn't open administrator w/o password and could only open bobby in safe mode...therefore all my desktop files (killbox, fixme, etc) were not there to perform the requested tasks. I then simply copied everything to "bobby"'s desktop and performed the HJT log, killbox, and fixme tasks as requested.

    This is only for information, as I don't know if it makes a difference in HJT, but I figured if you saw something out of place you better know exactly what I did.

    Thanks in advance :)

    Logfile of HijackThis v1.99.1
    Scan saved at 7:45:09 AM, on 7/27/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    D:\WINDOWS\System32\smss.exe
    D:\WINDOWS\system32\csrss.exe
    D:\WINDOWS\system32\winlogon.exe
    D:\WINDOWS\system32\services.exe
    D:\WINDOWS\system32\lsass.exe
    D:\WINDOWS\system32\svchost.exe
    D:\WINDOWS\system32\svchost.exe
    D:\WINDOWS\System32\svchost.exe
    D:\WINDOWS\System32\svchost.exe
    D:\WINDOWS\System32\svchost.exe
    D:\WINDOWS\system32\LEXBCES.EXE
    D:\WINDOWS\system32\spoolsv.exe
    D:\WINDOWS\system32\LEXPPS.EXE
    D:\WINDOWS\Explorer.EXE
    D:\WINDOWS\System32\hkcmd.exe
    D:\WINDOWS\BCMSMMSG.exe
    D:\PROGRA~1\PESTPA~1\PPControl.exe
    D:\PROGRA~1\PESTPA~1\PPMemCheck.exe
    D:\PROGRA~1\PESTPA~1\CookiePatrol.exe
    D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    D:\Program Files\MSN Messenger\msnmsgr.exe
    D:\WINDOWS\system32\ctfmon.exe
    D:\Program Files\iolo\System Mechanic 4\PopupStopper.exe
    D:\PROGRA~1\SPYWAR~1\swdoctor.exe
    D:\Program Files\Intuit\QuickBooks Pro\Components\QBAgent\qbdagent2001.exe
    D:\WINDOWS\system32\mrtMngr.EXE
    D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    D:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
    C:\iNtfySvc\intfysvc.exe
    D:\Program Files\Linksys\Wireless-G Notebook Adapter\WPC54Cfg.exe
    D:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    D:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
    D:\WINDOWS\System32\svchost.exe
    D:\WINDOWS\System32\wdfmgr.exe
    D:\WINDOWS\System32\alg.exe
    D:\Program Files\Internet Explorer\iexplore.exe
    D:\WINDOWS\system32\NOTEPAD.EXE
    D:\Documents and Settings\Bobby\Desktop\hijackthis_199\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.isearch.com/index.php?app=SE&affjump=1&affiliate=ODQ6NTo5&Terms=
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.isearch.com/index.php?app=SE&affjump=1&affiliate=ODQ6NTo5&Terms=
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.isearch.com/index.php?app=SE&affjump=1&affiliate=ODQ6NTo5&Terms=
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.isearch.com/index.php?app=SE&affjump=1&affiliate=ODQ6NTo5&Terms=
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 195.94.3.50:80
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - D:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
    O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - D:\Program Files\Ipswitch\WS_FTP Pro\wsbho2k0.dll
    O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - D:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O4 - HKLM\..\Run: [IgfxTray] D:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] D:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
    O4 - HKLM\..\Run: [PestPatrol Control Center] D:\PROGRA~1\PESTPA~1\PPControl.exe
    O4 - HKLM\..\Run: [PPMemCheck] D:\PROGRA~1\PESTPA~1\PPMemCheck.exe
    O4 - HKLM\..\Run: [CookiePatrol] D:\PROGRA~1\PESTPA~1\CookiePatrol.exe
    O4 - HKLM\..\Run: [PestPatrolCL] D:\PROGRA~1\PESTPA~1\PestPatrolCL.exe c:\
    O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [System Mechanic Popup Stopper] "D:\Program Files\iolo\System Mechanic 4\PopupStopper.exe"
    O4 - HKCU\..\Run: [Yahoo! Pager] D:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
    O4 - HKCU\..\Run: [Spyware Doctor] D:\PROGRA~1\SPYWAR~1\swdoctor.exe /Q
    O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: QuickBooks 2001 Delivery Agent.lnk = D:\Program Files\Intuit\QuickBooks Pro\Components\QBAgent\qbdagent2001.exe
    O4 - Global Startup: Wireless-G Notebook Adapter Utility.lnk = D:\Program Files\Linksys\Wireless-G Notebook Adapter\Startup.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - D:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: D:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: Tegrity-WebLearner-2385 - http://cite.nwmissouri.edu/tegrity/FreshSemValues/MJ%20Review%203a/Class/TWebS.CAB
    O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1099985017395
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
    O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
    O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://198.209.246.36/msrdp.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O20 - Winlogon Notify: igfxcui - D:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O23 - Service: Adobe LM Service - Unknown owner - D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: Ipswitch Notification Server (inotifysvr) - Ipswitch, Inc. 10 Maguire Road - Suite 220 Lexington MA. - C:\iNtfySvc\intfysvc.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - D:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: Macromedia Licensing Service - Macromedia - D:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
    O23 - Service: NICSer_WPC54G - Unknown owner - D:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe


    silent runner log:


    "Silent Runners.vbs", revision 39, http://www.silentrunners.org/
    Operating System: Windows XP SP2
    Output limited to non-default values, except where indicated by "{++}"


    Startup items buried in registry:

    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
    "msnmsgr" = ""D:\Program Files\MSN Messenger\msnmsgr.exe" /background" [MS]
    "ctfmon.exe" = "D:\WINDOWS\system32\ctfmon.exe" [MS]
    "System Mechanic Popup Stopper" = ""D:\Program Files\iolo\System Mechanic 4\PopupStopper.exe"" [empty string]
    "Yahoo! Pager" = "D:\Program Files\Yahoo!\Messenger\ypager.exe -quiet" ["Yahoo! Inc."]
    "Spyware Doctor" = "D:\PROGRA~1\SPYWAR~1\swdoctor.exe /Q" ["PCTools"]

    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
    "IgfxTray" = "D:\WINDOWS\System32\igfxtray.exe" ["Intel Corporation"]
    "HotKeysCmds" = "D:\WINDOWS\System32\hkcmd.exe" ["Intel Corporation"]
    "BCMSMMSG" = "BCMSMMSG.exe" ["Broadcom Corporation"]
    "PestPatrol Control Center" = "D:\PROGRA~1\PESTPA~1\PPControl.exe" ["Computer Associates International"]
    "PPMemCheck" = "D:\PROGRA~1\PESTPA~1\PPMemCheck.exe" [null data]
    "CookiePatrol" = "D:\PROGRA~1\PESTPA~1\CookiePatrol.exe" ["Computer Associates International"]
    "PestPatrolCL" = "D:\PROGRA~1\PESTPA~1\PestPatrolCL.exe c:\" ["Computer Associates International, Inc."]
    "AVG7_CC" = "D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP" ["GRISOFT, s.r.o."]
    "KernelFaultCheck" = "D:\WINDOWS\system32\dumprep 0 -k" [MS]

    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
    {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]
    -> {CLSID}\InProcServer32\(Default) = "D:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string]
    {53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
    -> {CLSID}\InProcServer32\(Default) = "D:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]
    {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB}\(Default) = "PCTools Site Guard" [from CLSID]
    -> {CLSID}\InProcServer32\(Default) = "D:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll" ["PC Tools"]
    {601ED020-FB6C-11D3-87D8-0050DA59922B}\(Default) = "Ipswitch.WsftpBrowserHelper"
    -> {CLSID}\InProcServer32\(Default) = "D:\Program Files\Ipswitch\WS_FTP Pro\wsbho2k0.dll" ["Ipswitch, Inc. 10 Maguire Road - Suite 220 Lexington, MA 02421"]
    {B56A7D7D-6927-48C8-A975-17DF180C71AC}\(Default) = "PCTools Browser Monitor" [from CLSID]
    -> {CLSID}\InProcServer32\(Default) = "D:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll" ["GuideWorks Pty. Ltd."]

    HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
    "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Display Panning CPL Extension"
    -> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
    "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext"
    -> {CLSID}\InProcServer32\(Default) = "D:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
    "{5464D816-CF16-4784-B9F3-75C0DB52B499}" = "Yahoo! Mail"
    -> {CLSID}\InProcServer32\(Default) = "D:\PROGRA~1\Yahoo!\Common\ymmapi.dll" ["Yahoo! Inc."]
    "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
    -> {CLSID}\InProcServer32\(Default) = "D:\Program Files\WinRAR\rarext.dll" [null data]
    "{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
    -> {CLSID}\InProcServer32\(Default) = "D:\WINDOWS\System32\Audiodev.dll" [MS]
    "{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
    -> {CLSID}\InProcServer32\(Default) = "D:\WINDOWS\System32\Audiodev.dll" [MS]
    "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
    -> {CLSID}\InProcServer32\(Default) = "D:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS]
    "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler"
    -> {CLSID}\InProcServer32\(Default) = "D:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS]
    "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler"
    -> {CLSID}\InProcServer32\(Default) = "D:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS]
    "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Shell Extension"
    -> {CLSID}\InProcServer32\(Default) = "D:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
    "{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Find Extension"
    -> {CLSID}\InProcServer32\(Default) = "D:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]

    HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
    INFECTION WARNING! igfxcui\DLLName = "igfxsrvc.dll" ["Intel Corporation"]

    HKLM\Software\Classes\PROTOCOLS\Filter\
    INFECTION WARNING! text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}"
    -> {CLSID}\InProcServer32\(Default) = "D:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS]

    HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
    AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"
    -> {CLSID}\InProcServer32\(Default) = "D:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
    HexWorkshopContextMenu\(Default) = "{DB34D5DC-D41A-482E-A5EF-8FA0F88761DA}"
    -> {CLSID}\InProcServer32\(Default) = "D:\Program Files\BreakPoint Software\Hex Workshop 4.2\hwext.dll" ["BreakPoint Software, Inc."]
    WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
    -> {CLSID}\InProcServer32\(Default) = "D:\Program Files\WinRAR\rarext.dll" [null data]
    WS_FTP\(Default) = "{797F3885-5429-11D4-8823-0050DA59922B}"
    -> {CLSID}\InProcServer32\(Default) = "D:\Program Files\Ipswitch\WS_FTP Pro\wsftpsi.dll" ["Ipswitch, Inc. 10 Maguire Road - Suite 220 Lexington, MA 02421"]
    Yahoo! Mail\(Default) = "{5464D816-CF16-4784-B9F3-75C0DB52B499}"
    -> {CLSID}\InProcServer32\(Default) = "D:\PROGRA~1\Yahoo!\Common\ymmapi.dll" ["Yahoo! Inc."]

    HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
    WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
    -> {CLSID}\InProcServer32\(Default) = "D:\Program Files\WinRAR\rarext.dll" [null data]

    HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
    AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"
    -> {CLSID}\InProcServer32\(Default) = "D:\Program Files\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
    WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
    -> {CLSID}\InProcServer32\(Default) = "D:\Program Files\WinRAR\rarext.dll" [null data]
    WS_FTP\(Default) = "{797F3885-5429-11D4-8823-0050DA59922B}"
    -> {CLSID}\InProcServer32\(Default) = "D:\Program Files\Ipswitch\WS_FTP Pro\wsftpsi.dll" ["Ipswitch, Inc. 10 Maguire Road - Suite 220 Lexington, MA 02421"]


    Default executables:

    .SCR: HKLM\SOFTWARE\Classes\AutoCADScript\shell\open\command\
    INFECTION WARNING! "Default" = "D:\WINDOWS\NOTEPAD.EXE "%1"" [MS]


    Active Desktop and Wallpaper:

    Active Desktop is disabled at this entry:
    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

    HKCU\Control Panel\Desktop\
    "Wallpaper" = "D:\WINDOWS\web\wallpaper\Bliss.bmp"


    Enabled Screen Saver:

    HKCU\Control Panel\Desktop\
    "SCRNSAVE.EXE" = "D:\WINDOWS\System32\logon.scr" [MS]


    Startup items in "Bobby" & "All Users" startup folders:

    D:\Documents and Settings\All Users\Start Menu\Programs\Startup
    "Adobe Gamma Loader" -> shortcut to: "D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."]
    "QuickBooks 2001 Delivery Agent" -> shortcut to: "D:\Program Files\Intuit\QuickBooks Pro\Components\QBAgent\qbdagent2001.exe" [empty string]
    "Wireless-G Notebook Adapter Utility" -> shortcut to: "D:\Program Files\Linksys\Wireless-G Notebook Adapter\Startup.exe" [empty string]


    Enabled Scheduled Tasks:

    "TASK20041111223948" -> launches: "D:\Program Files\Ipswitch\WS_FTP Pro\wsftppro.exe -m "D:\Documents and Settings\Bobby\Application Data\Ipswitch\WS_FTP\Scheduler\sch44.tmp"" [null data]
    "TASK20041129102105" -> launches: "D:\Program Files\Ipswitch\WS_FTP Pro\wsftppro.exe -m "D:\Documents and Settings\Bobby\Application Data\Ipswitch\WS_FTP\Scheduler\sch62.tmp"" [null data]


    Winsock2 Service Provider DLLs:

    Namespace Service Providers

    HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
    000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
    000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
    000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

    Transport Service Providers

    HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
    0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
    %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15
    %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


    Toolbars, Explorer Bars, Extensions:

    Explorer Bars

    Dormant Explorer Bars in "View, Explorer Bar" menu

    HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\ = "&Research"
    Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
    InProcServer32\(Default) = "D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS]

    Extensions (Tools menu items, main toolbar menu buttons)

    HKLM\Software\Microsoft\Internet Explorer\Extensions\
    {2D663D1A-8670-49D9-A1A5-4C56B4E14E84}\
    "ButtonText" = "Spyware Doctor"
    "CLSIDExtension" = "{A1EDC4A1-940F-48E0-8DFD-E38F1D501021}"
    -> {CLSID}\InProcServer32\(Default) = "D:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll" ["GuideWorks Pty. Ltd."]

    {92780B25-18CC-41C8-B9BE-3C9C571A8263}\
    "ButtonText" = "Research"

    {FB5F1910-F110-11D2-BB9E-00C04F795683}\
    "ButtonText" = "Messenger"
    "MenuText" = "Windows Messenger"
    "Exec" = "D:\Program Files\Messenger\msmsgs.exe" [MS]


    Running Services (Display Name, Service Name, Path {Service DLL}):

    AVG7 Alert Manager Server, Avg7Alrt, "D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe" ["GRISOFT, s.r.o."]
    AVG7 Update Service, Avg7UpdSvc, "D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe" ["GRISOFT, s.r.o."]
    Ipswitch Notification Server, inotifysvr, "C:\iNtfySvc\intfysvc.exe" ["Ipswitch, Inc. 10 Maguire Road - Suite 220 Lexington MA. "]
    LexBce Server, LexBceS, "D:\WINDOWS\system32\LEXBCES.EXE" ["Lexmark International, Inc."]
    Machine Debug Manager, MDM, ""D:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE"" [MS]
    Windows User Mode Driver Framework, UMWdf, "D:\WINDOWS\System32\wdfmgr.exe" [MS]

    + This report excludes default entries except where indicated.
    + To see *everywhere* the script checks and *everything* it finds,
    launch it from a command prompt or a shortcut with the -all parameter.
    + The search for DESKTOP.INI DLL launch points on all local fixed drives
    took 137 seconds.
    + The search for all Registry CLSIDs containing dormant Explorer Bars
    took 37 seconds.
    (total run time: 220 seconds)


    Thanks again, Crunchie... I appreciate all you help.


    PK
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited July 2005
    You have some entries there that need removing.

    ===============

    Still in HiJackThis, click "Scan", then check(tick) the following, if present:


    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.isearch.com/index.php?ap...ODQ6NTo5&Terms=
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.isearch.com/index.php?ap...ODQ6NTo5&Terms=
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.isearch.com/index.php?ap...ODQ6NTo5&Terms=
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.isearch.com/index.php?ap...ODQ6NTo5&Terms=
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=


    Now, close all instances of Internet Explorer and any other windows you have open except HiJackThis, click "Fix checked".

    ===============

    Silent runners log looks clear. How is your PC now?
  • TherealpizzakingTherealpizzaking Northwest MO
    edited July 2005
    I fixed the above items in HJT, and rebooted, but the task manager was still disabled. I then ran a taskmanagerenable script (I think off of dougknox.com) and it ran and enabled the task manager. This was unsuccessful in previous attempts.

    Thanks for getting me this far, but I still get several error messages coming up when I boot up, particularly in Pest Patrol, which shows the following problems. I have tried to remove them with Pest patrol, but they don't seem to go away.

    Should I post this as a new thread? LMK.

    Again, thank you for your time and professional help!

    Scan of 7/27/2005 9:29:47 PM
    User Name: ponyexpress
    MAC Address: 00-0D-56-B2-E7-50
    Computer Name: ou812
    Volume Name: Music
    File System Name: NTFS
    Volume Serial No: 146869844
    Windows Version: Windows XP
    D:\PROGRA~1\PESTPA~1\PestPatrolCL.exe 4.4.4.80
    PPClean.exe: 7/8/2005 4.5.9.5
    Pest Database: 7/7/2005

    Scanning controlled from the command line with these parameters:
    - c:\


    Pest Detected in HKEY_LOCAL_MACHINE\software\classes\clsid\{558ec983-bedb-9168-b2de-31dbf0ee543e}
    Pest: BearShare
    Action taken: Ignored this time


    Pest Detected in HKEY_LOCAL_MACHINE\software\classes\ed2k
    Pest: BearShare
    Action taken: Ignored this time


    Pest Detected in HKEY_LOCAL_MACHINE\software\classes\ed2k|url protocol
    Pest: BearShare
    Action taken: Ignored this time


    Pest Detected in HKEY_LOCAL_MACHINE\software\classes\ed2k\defaulticon
    Pest: BearShare
    Action taken: Ignored this time


    Pest Detected in HKEY_LOCAL_MACHINE\software\classes\ed2k\shell\open\command
    Pest: BearShare
    Action taken: Ignored this time


    Pest Detected in HKEY_LOCAL_MACHINE\software\classes\ed2k\shell\open\ddeexec
    Pest: BearShare
    Action taken: Ignored this time


    Pest Detected in HKEY_LOCAL_MACHINE\software\classes\gnu|url protocol
    Pest: BearShare
    Action taken: Ignored this time


    Pest Detected in HKEY_LOCAL_MACHINE\software\classes\gnu
    Pest: BearShare
    Action taken: Ignored this time


    Pest Detected in HKEY_LOCAL_MACHINE\software\classes\gnu\defaulticon
    Pest: BearShare
    Action taken: Ignored this time


    Pest Detected in HKEY_LOCAL_MACHINE\software\classes\gnu\shell\open\command
    Pest: BearShare
    Action taken: Ignored this time


    Pest Detected in HKEY_LOCAL_MACHINE\software\classes\gnufile|browserflags
    Pest: BearShare
    Action taken: Ignored this time


    Pest Detected in HKEY_LOCAL_MACHINE\software\classes\gnufile|editflags
    Pest: BearShare
    Action taken: Ignored this time


    Pest Detected in HKEY_LOCAL_MACHINE\software\classes\gnufile\shell\open\command
    Pest: BearShare
    Action taken: Ignored this time


    Pest Detected in HKEY_LOCAL_MACHINE\software\classes\gnutella|url protocol
    Pest: BearShare
    Action taken: Ignored this time


    Pest Detected in HKEY_LOCAL_MACHINE\software\classes\gnutella\defaulticon
    Pest: BearShare
    Action taken: Ignored this time


    Pest Detected in HKEY_LOCAL_MACHINE\software\classes\gnutella\shell\open\command
    Pest: BearShare
    Action taken: Ignored this time


    Pest Detected in HKEY_LOCAL_MACHINE\software\classes\gnutella\shell\open\ddeexec
    Pest: BearShare
    Action taken: Ignored this time


    Pest Detected in HKEY_LOCAL_MACHINE\software\licenses|{i56b3cf0d9ab991e1}
    Pest: BearShare
    Action taken: Ignored this time


    Pest Detected in HKEY_LOCAL_MACHINE\software\licenses|{056b3cf0d9ab991e1}
    Pest: BearShare
    Action taken: Ignored this time


    Pest Detected in HKEY_LOCAL_MACHINE\software\classes\gnutella
    Pest: BearShare
    Action taken: Ignored this time


    Pest Detected in HKEY_CLASSES_ROOT\gnufile
    Pest: BearShare
    Action taken: Ignored this time


    Pest Detected in HKEY_CLASSES_ROOT\software\classes\quicksearch.searchband
    Pest: Ezula
    Action taken: Ignored this time


    Pest Detected in HKEY_LOCAL_MACHINE\software\magnet
    Pest: KaZaA
    Action taken: Ignored this time


    Pest Detected in HKEY_CLASSES_ROOT\gnutella
    Pest: XoloX
    Action taken: Ignored this time



    PestPatrolCL scanned c:\ checking 2,688 files in this area as well as checking for
    12,099 Spyware registry entries, 13,219 Spyware files, and 1,098 Spyware directories.

    Found 24 pests!
    0:02:50
    Exited with error level of 2
    ~~~

    NEVERMIND... After I rebooted with the task manager enabled, pest patrol was able to delete the above pests... computer seems clean now!

    thanks a million crunchie. I owe you some beer and pizza!
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited July 2005
    You are welcome. Glad you got it sorted :).

    Now that your PC is clean you need to follow these easy steps to keeping it this way:

    Secure your Internet Explorer by going here and following the instructions there.

    Better yet, use an alternative browser! Download FireFox and give it a run. It is far more secure than Internet Explorer. Or, you can get Opera which in my opinion, is better still.

    Use a firewall to help prevent your PC's control being usurped by undesireables. There is a link to a good, free firewall in my signature.

    Install and keep updated, Ad-Aware SE, and Spybot S&D.
    Run them both on a regular basis, following the manufacturer's recommendations.

    Install an anti-virus. There are some good, free AV's available today. Make sure that it is updated regularly and have it scan your system often.

    Check for Windows Updates. Microsoft regularly post updates for your systems safe running. Make sure to take advantage of this. Reboot when installed and return to make sure there are no others.


    Clear your Temp folders.
    Clear out your Temporary internet files and other temp files.
    Go to Start > Settings > Control Panel >Internet Options.
    Under the General tab click the Delete temporary internet files,
    delete all Offline content as well. Clear out Cookies.

    Also, go to Start > Find/search > Files or folders > in the named box, type: *.tmp and choose Edit > select all -> File > delete.

    Empty/delete the entire contents of the C:\Windows\temp folder and C:\temp folder, if you have one. (Contents but not the folder itself.)

    C:\Documents and Settings\username\Local Settings\Temp\

    In order to view these files you may have to select 'show hidden files/folders.' Instructions on how to here.

    Empty the Recycle Bin.

    After something like this it is a good idea to Flush the Restore Points and start fresh.
    To flush the XP system Restore Points.

    Go to Start>Run and type msconfig. Press enter.

    When msconfig opens, click the Launch System Restore Button.
    On the next page, click the System Restore Settings link on the left.

    Check the box labelled 'Turn off System restore'.

    Reboot. Go back in and Turn System Restore Back on. A new Restore Point will be created.

    Note that all previous restore points will be lost.
Sign In or Register to comment.